Container Registry

A registry is not just storage, it's the trust boundary between "someone built this" and "production is running it." Most registry incidents trace back to one thing: a tag that meant one image yesterday and a different one today, with nothing in the deploy pipeline able to tell.

A tag you can overwrite is not a version, it's a pointer with a rumor attached.

1. Never deploy off a mutable tag

latest, and any tag your CI re-pushes on every build, can change underneath a running deployment with no record of what actually shipped. Tag every build with something immutable — a git SHA, a semantic version, or the content digest itself — and deploy by that identifier. Mutable, human-friendly tags (stable, latest) are fine as a pointer for humans browsing the registry, but the deploy manifest should always reference the immutable tag or digest underneath.